Staff Application Security Engineer – M&A

This is a fully remote position, open to applicants in California, +2 more states.

📋 Description

• Oversee pre-close security due diligence on potential acquisitions — manage external penetration testing, evaluate the target's architecture through threat modeling, assess security controls, and present the security risk summary to leadership prior to closing and integration planning.

• Facilitate post-close security integration — establish static and dynamic analysis coverage on acquired codebases, monitor high- and critical-severity issues to resolution, incorporate acquired assets into the bug bounty program, and integrate repositories into Anthropic's automated vulnerability remediation and reporting systems.

• Collaborate with related security engineering teams (supply chain, cloud, corporate security, detection & response) regarding their responsibilities in each integration.

• Engage with a diverse group of stakeholders on every acquisition — including corporate development, legal, security leadership, and the engineering teams tasked with handling the acquired systems internally; as well as engineering and security teams at the target company externally — facilitating communication and ensuring the security workstream is clear to all parties involved.

• Develop and expand Anthropic's M&A security playbook — including risk-scoring models, diligence runbooks, and integration checklists — and automate as many processes as possible using Claude-powered tools instead of relying solely on manual methods.

• Participate in the team’s operational on-call rotation (bug bounty escalations, launch consultations, incident response), providing coverage during active deal periods.

• Contribute to essential AppSec projects during inter-deal periods — secure design reviews, threat modeling for agentic systems, and the team’s security automation roadmap.

⛳️ Requirements

• Practical experience in application and infrastructure security, particularly in cloud and containerized environments.

• Proven ability to swiftly evaluate an unfamiliar codebase or architecture and generate a clear, prioritized risk assessment suitable for a non-security audience.

• Proficiency in production-level coding in at least one of the following languages: Python, Go, Rust, or TypeScript.

• Hands-on threat modeling and vulnerability identification skills — you have successfully discovered and analyzed real bugs in actual systems.

• Ability to operate with a high degree of autonomy, navigate ambiguity, and handle sensitive confidential information.

• Strong written and verbal communication skills tailored to diverse audiences — including executives, legal and corporate development partners, and engineering counterparts at an acquired organization.

🏝️ Benefits

• Competitive compensation and benefits.

• Optional equity donation matching.

• Generous vacation and parental leave.

• Flexible working hours.

• Pleasant office environment for collaboration.